Content

Adware-SpyFalcon

Type
Program
SubType
Adware
Discovery Date
02/13/2006
Minimum DAT
4695 (02/13/2006)
Updated DAT
4695 (02/13/2006)
Minimum Engine
5.1.00
Description Added
02/13/2006
Description Modified
02/16/2006 1:13 PM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program". This is an anti-spyware application claiming to remove unwanted malicious spyware programs. It is a re-branding of Adware-Spyaxe , which is known to be installed by a Trojan (see Spyaxe ) that displays fake warnings (some appearing to be Microsoft Security Center or Windows Update warnings) which may lead you to believe that your computer is infected with malicious spyware programs. In order to clean or delete any files labeled as “malicious spyware”, you must first enter a valid serial number to activate the full version or click on the “Buy Online” button and purchase the full version.

This application displays a license agreement when installed. The agreement appears to be a standard legal boilerplate and does not clearly indicate the functionality of the software. A copy of the EULA was not available on the spyfalcon.com website.  

Privacy

A privacy policy is not displayed during installation. However, a policy can be accessed on the author's website: http://www.spyfalcon/privacy.php

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files
%UserProfile% = \Documents and Settings\(user name)

"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

  • Installer: 8993fe21.exe (name may vary) (2852 KB)
    MD5: 43159F8D76C1C9C1F94DC935ED29595B
  • %ProgramFiles%\spyfalcon\uninst.exe (40 KB)
    MD5: 2C7EF00E8CF52C523E2AA1BB84195923
  • %ProgramFiles%\spyfalcon\syg.db (1048 KB)
  • %ProgramFiles%\spyfalcon\spyfalcon.url (1 KB)
  • %ProgramFiles%\spyfalcon\spyfalcon.exe (1704 KB)
    MD5: 1C5C95FBAD852409B934752839738546
  • %ProgramFiles%\spyfalcon\msvcr71.dll* (340 KB)
  • %ProgramFiles%\spyfalcon\msvcp71.dll* (488 KB)
  • %ProgramFiles%\spyfalcon\blacklist.txt (49 KB)
  • %ProgramFiles%\spyfalcon\lang\english.ini (31 KB)
  • %ProgramFiles%\spyfalcon\logs\
  • %ProgramFiles%\spyfalcon\quarantine\
  • %UserProfile%\start menu\spyfalcon 2.0.lnk (1 KB)
  • %UserProfile%\start menu\programs\spyfalcon\uninstall spyfalcon 2.0.lnk (1 KB)
  • %UserProfile%\start menu\programs\spyfalcon\spyfalcon 2.0.lnk (1 KB)
  • %UserProfile%\start menu\programs\spyfalcon\spyfalcon 2.0 website.lnk (1 KB)
  • %UserProfile%\desktop\spyfalcon.lnk (1 KB)
  • %UserProfile%\application data\microsoft\internet explorer\quick launch\spyfalcon 2.0.lnk (1 KB)

Registry

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\SOFTWARE\SpyFalcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Uninstall\SpyFalcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "SpyFalcon"="C:\Program Files\SpyFalcon\SpyFalcon.exe /h"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \App Paths\SpyFalcon.exe
    "default"="C:\Program Files\SpyFalcon\SpyFalcon.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
    "{0484BBA8980BF0CFD}"="(hex data)"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
    "{I484BBA8980BF0CFD}"="06-00-00-00"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
    "{K7C0DB872A3F777C0}"="(hex data)"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
    "{R7C0DB872A3F777C0}"="4A-8D-7D-4C"
  • HKEY_CLASSES_ROOT\TypeLib\{244B730E-D899-4E38-9428-03D1143242E0}
  • HKEY_CLASSES_ROOT\Interface\{B7C685F0-1804-4382-A8EF-17D33DF97069}
  • HKEY_CLASSES_ROOT\Interface\{8C803228-BD61-4744-8B79-949E3F512DDC}
  • HKEY_CLASSES_ROOT\Interface\{850300D6-D53B-4720-9372-6D31B85537E1}
  • HKEY_CLASSES_ROOT\Interface\{701E8C3A-7910-4CCD-A9F8-7B9A5F5B3947}
  • HKEY_CLASSES_ROOT\Interface\{6876543E-DA55-4F90-9CD2-5ED380D9516C}
  • HKEY_CLASSES_ROOT\Interface\{5B861FB8-903C-4996-B1D3-E9A86ED4BBCF}
  • HKEY_CLASSES_ROOT\Interface\{37B9988B-1997-41F4-A832-DAE42CC3F7C2}
  • HKEY_CLASSES_ROOT\Interface\{3261F690-1CA4-4839-928B-F4F898B74EB7}
  • HKEY_CLASSES_ROOT\Interface\{255CDDA3-576B-44C9-B944-46EAC18D5D6F}
  • HKEY_CLASSES_ROOT\Interface\{23D80835-4A3A-4572-9F5F-3F24A7A28AE5}
  • HKEY_CLASSES_ROOT\Interface\{20C59F9F-33CB-4B1B-AFB6-B710DB845709}
  • HKEY_CLASSES_ROOT\Interface\{200BD3A6-A02B-4BAC-A364-A9D8017E3C4E}
  • HKEY_CLASSES_ROOT\Interface\{1694E5C6-9E1F-4C3B-B79A-828C2FC40003}
  • HKEY_CLASSES_ROOT\Interface\{163469FD-6009-48E2-AD8C-47BB2E0D88BE}
  • HKEY_CLASSES_ROOT\Interface\{0FBBBC44-296D-4A2F-AF45-BE1EE387F569}
  • HKEY_CLASSES_ROOT\Interface\{001501E7-C970-4CB1-9740-E055BF3DDFD6}
  • HKEY_CLASSES_ROOT\CLSID\{330A77C2-C15A-43B5-055C-B4E35EAED279}

Network Impact

Possible increase in overhead bandwidth due to download of additional components or updates.

Aliases

Aliases

    N/A